All 100 ideasPrivacy and security
#85 of 100 · Privacy and security
Fence in apps and AI agents
Simple per-app limits on folders, network and personal data, including fake contacts, with prompts when an app or AI agent reaches outside.
Asks per year
What the askers want
- Would pay0%
- Want it local or private88%
- Object to subscriptions0%
- Want it open source or self-hosted0%
- Want AI to do it0%
Share of the 8 asks that say so, as judged by Jev.
What exists on Show HN
Built, still asked for27 Show HN launches do this job, and 16 more do part of it. People still ask, so the launches are missed, unknown, or not what they want. Ask what they’re missing before you build.
- Drop – A rootless Linux sandbox with gVisor support2026 · 193 pts
- Zerobox – Sandbox any command with file, network, credential controls2026 · 141 pts
- Fence – Sandbox CLI commands with network/filesystem restrictions2026 · 78 pts
- Sandboxing untrusted code using WebAssembly2026 · 76 pts
- Run coding agents in microVM sandboxes instead of your host machine2026 · 63 pts
- FSSB – A filesystem sandbox for Linux2016 · 43 pts
- Nucleus – A security-hardened, Nix-native container runtime2026 · 40 pts
- BVisor – An Embedded Bash Sandbox, 2ms Boot, Written in Zig2026 · 24 pts
The idea, as matched
A tool that confines an app or AI agent on my computer or phone to chosen folders, network access and data, or feeds it fake contacts and location, with simple per-app controls.
Jev first matched 11 requests to this idea; a second reader kept 8 of 11.
Every ask, newest first
Each line is an AI paraphrase of what the writer wanted. The link goes to their own words on Hacker News.
Reader’s note. Newest ask is about AI coding agents.
- Feb 2026Wants a Lulu-like Mac tool that confines an app or AI agent to one folder and prompts otherwise. Read it: a comment in “Claude Sonnet 4.6”
- Aug 2025Wants Docker-for-phones sandboxing so apps cannot have constant access to location and activity. Read it: a comment in “Google will allow only apps from verified developers to be installed on Android”
- Apr 2025Wants a hide-my-email style restricted sandbox for apps that should not need an app. Read it: a comment in “I thought I bought a camera, but no DJI sold me a license to use it [video]”
- Mar 2025Wants an option to feed apps random fake contacts that look real. Read it: a comment in “Everyone knows all the apps on your phone”
- Jan 2022Asks for a Linux tool, ideally in Ubuntu repos, that blocks or sandboxes programs' network access. Read it: a comment in “Show HN: Picosnitch – a reliable and lightweight security/privacy tool for Linux”
- Apr 2021Wants a way to completely block an app's network access so it cannot upload data. Read it: a comment in “Why isn't webapp preferred over native app?”
- Jan 2021Wants a way to run work software like Teams isolated from personal browsing and email without audio delay. Read it: a comment in “I looked at all the ways Microsoft Teams tracks users”
- May 2019Wants a file browser with no network access and network apps with no extra file permissions. Read it: a comment in “Google Fights Back”
Building this?
Read ten of the asks above first, because they say what the existing launches miss. If you ship it, post it as a Show HN so the next run of this list finds it.
Ship it like Vercel, on a server you own
This site runs on ShipTiffin. A push to GitHub deploys it, the way it would on Vercel, but the server is a Hetzner box in your own account. Postgres, sign-in, email, jobs and analytics are already on it, every project gets a hard limit, and nothing is billed by usage.
$19 a month per box, plus about $10 for the server at Hetzner. Open source, so you can also run it yourself for free.